Privacy Policy

WebPilot ("we", "us") is an online SEO and performance audit service operated by Do Thanh Duy, an individual sole trader based in Vietnam, who is the controller of your personal data. For privacy questions or requests, contact support@webpilotaudit.com.

Account data. If you sign in, we use Google sign-in. We receive your name, email address and Google account ID. We never see your Google password.

Websites and audit data. The domains you add or scan, the audit results and scores, your history of past audits, and any competitor URLs you enter.

Payment data. Payments are handled by Paddle.com, which acts as Merchant of Record and collects your payment and billing details under its own privacy policy. We receive an order reference, the product bought, the amount, and the status. We never receive or store your full card number.

Technical data. IP address, browser type and basic request logs, used for security, abuse prevention and rate limiting.

Communications. Messages you send to support, including refund requests.

We do not knowingly collect special-category data, and the service is not intended for children under 16.

• To run the audits you request and show you the results.
• To save your audit history and let you compare runs over time.
• To process payments, credits and refunds.
• To keep the service secure, prevent abuse and enforce rate limits.
• To respond to support requests and send essential service emails (for example, receipts).
• To improve the product using aggregated, non-identifying usage statistics.

We do not sell your personal data, and we do not use it for advertising profiles.

Where UK GDPR or EU GDPR applies, we rely on: contract (to provide the audits you ask for), legitimate interests (security, abuse prevention, product improvement), legal obligation (tax and accounting records), and consent where we ask for it, which you can withdraw at any time.

When you run an audit, our crawler makes ordinary public requests to the website you enter, and to any competitor sites you add. It identifies itself as WebPilotAuditBot/1.0, respects robots.txt, keeps its request rate low, and stops if the site signals it is overloaded. We only read publicly available pages. We do not log in to sites, submit forms, or attempt to bypass access controls.

Site owners who want the crawler blocked can disallow WebPilotAuditBot in robots.txt or email us.

Quick (free) scan results describe a public website, not you. The latest quick-scan result for a domain (its scores and public-page findings) may be shown to other signed-in users who scan the same domain within 24 hours, and the domain, its score and the time scanned may appear in the "recently scanned" and "top scores" lists. If you choose "Feature my site" when you scan, the list also links to your website (a nofollow link). Your name and email are never shown. Full audits and your workspace are private to your account. If you would like a domain removed from public lists, email us and we will remove it.

To write plain-English explanations, action plans and competitor content-gap summaries, we send excerpts of publicly visible page text and audit measurements to an AI provider (currently Anthropic, maker of Claude). We send only what is needed for the task and do not send your account details. Under the provider's API terms, this data is not used to train its models. AI output can be wrong; please verify important changes yourself.

We share data only with service providers that help us run WebPilot, under appropriate terms:

• Supabase: database and authentication (hosts account and audit data).
• Google: sign-in, the PageSpeed Insights API used to supplement performance measurements, and Google Analytics 4 (only if you accept analytics cookies).
• Anthropic: AI explanations (see section 7).
• Paddle.com (Merchant of Record): processing payments, invoices, tax, refunds and fraud checks.
• Hosting and network providers (Vercel, Oracle Cloud, Cloudflare) and our email provider: delivering the site, the audit service and our messages.

We may also disclose data if required by law, or to protect our rights, users or the public from fraud or abuse. If the business is sold or merged, data may transfer to the new owner under this policy.

We operate from Vietnam, and our providers may process data in the United States, the EU and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses or equivalent protections offered by our providers.

• Account and audit history: until you delete it or close your account.
• Payment and tax records: as long as the law requires (typically several years).
• Server and security logs: up to 90 days unless needed to investigate abuse.
• Support emails: up to 3 years after the conversation ends.

Always on (strictly necessary). An authentication session stored in your browser to keep you signed in, and simple preferences such as your scan confirmation and your cookie choice. These do not track you across sites.

Analytics (only with your consent). If you click "Accept" on the cookie banner, we load Google Analytics 4, which sets first-party cookies (_ga, _ga_*, kept for up to 2 years) to count visits and see which pages help people. We send page paths without query strings, so the website addresses you scan, your email and your account ID are never sent to Google. Advertising features and ad personalisation are off. If you click "Reject" or do nothing, Google Analytics is not loaded at all.

We do not use advertising or cross-site tracking cookies.

You can change your choice at any time: Cookie settings. Rejecting after accepting deletes the Google Analytics cookies on this site.

Depending on where you live (including the UK/EU under GDPR, Australia under the Privacy Act 1988, and California under the CCPA/CPRA), you may have the right to:

• access the personal data we hold about you and get a copy;
• correct inaccurate data;
• delete your data (you can delete websites and audits yourself in your workspace, or ask us to delete your account);
• object to or restrict certain processing, and withdraw consent;
• receive your data in a portable format;
• not be discriminated against for exercising your rights, and to opt out of any sale or sharing of personal data (we do neither).

Email support@webpilotaudit.com from the address on your account and we will respond within 30 days. You may also complain to your local regulator: the ICO (UK), the OAIC (Australia), or your state or EU data protection authority.

We use encryption in transit, per-user access controls on stored audit data, and rate limiting. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your data, we will notify you and the relevant authorities as required by law.

We may update this policy as the service changes. We will change the date at the top and, for significant changes, notify signed-in users by email or in the app.